HIPAA Estate Planning Guide 2026

Short answer: A HIPAA authorization is a signed form that lets your doctors and hospitals share your health information with the people you name (45 C.F.R. §164.508). Your health care agent already gets access once the agent’s authority kicks in (Prob. Code §4678), but under California’s default rule that happens only after a physician finds you lack capacity (Prob. Code §4682). The HIPAA authorization covers the window before that finding, and it reaches people who aren’t your health care agent.

You’ll often hear that a health care power of attorney doesn’t give anyone access to your medical records. That overstates it. The real gap is narrower. It’s about timing, and about the other people who need the information.

Law verified against 45 C.F.R. §§164.502, 164.508 and 164.510, Civil Code §56.11, and Probate Code §§4658, 4678, 4682 and 4683, 2026. This is general information, not legal advice for your situation.

What does a HIPAA release form do?

It gives a doctor, hospital, pharmacy, or health plan your written permission to disclose your health information to a named person. Without it, a provider’s ability to talk to your family depends on narrower rules. A provider may share information directly relevant to a family member’s involvement in your care, and if you’re incapacitated, the provider uses professional judgment to decide whether disclosure is in your best interest (45 C.F.R. §164.510(b)). That’s permission to share, not an obligation, and it covers only what’s relevant to that person’s involvement.

A signed authorization replaces the judgment call with your own instructions. To be valid under the federal rule, it must describe the information, identify who may disclose it and who may receive it, state the purpose, include an expiration date or event, and carry your signature and the date (45 C.F.R. §164.508(c)(1)).

Isn’t that already covered by my health care power of attorney?

Partly. California gives a person then authorized to make your health care decisions the same right you have to request, receive, examine, and copy your medical information (Prob. Code §4678). Federal law agrees: a person with authority under state law to make health care decisions for an adult must be treated as that adult’s personal representative (45 C.F.R. §164.502(g)(2)).

The catch is the word “then.” Unless your directive says otherwise, your agent’s authority starts only on a determination that you lack capacity (Prob. Code §4682), and that determination is made by your primary physician (Prob. Code §4658). Before that, your agent stands where any other relative stands. That’s the moment families most need information: a parent is confused after a fall, the diagnosis is unclear, and the children are trying to learn whether it’s time to step in.

There are two ways to close that gap, and a plan can use both. One is drafting the advance health care directive so the agent’s authority is effective immediately, which Probate Code §4682 allows. The other is a stand-alone HIPAA authorization naming the agent and anyone else who may need records.

Does anyone besides my health care agent need access?

Often, yes. The person acting under your durable power of attorney for finances isn’t a health care agent unless you named them as one, so they have no automatic access. They may still need medical records to show a bank or insurer that you’re incapacitated, or to handle a long-term care claim. A successor trustee under a living trust faces the same problem when the trust says the trustee takes over on your incapacity and a financial institution wants proof.

After death, the rules change. Your agent can authorize release of your records to the extent needed to carry out the agent’s post-death duties, such as authorizing an autopsy or directing disposition of remains (Prob. Code §4683(b)). An executor or administrator with authority to act for the estate is treated as your personal representative for relevant information (45 C.F.R. §164.502(g)(4)). California also lets a beneficiary or personal representative of a deceased patient sign a release (Civ. Code §56.11(b)(3)(D)).

What does California require on top of HIPAA?

California’s Confidentiality of Medical Information Act has its own list, and a form that satisfies only the federal rule can fail it. A valid California authorization has to meet these requirements.

• Be handwritten or in type no smaller than 14 point (Civ. Code §56.11(b)(1)).
• Be set apart from other language on the page and signed with a signature that serves no other purpose (Civ. Code §56.11(b)(2)).
• State the specific uses and limits on the information disclosed, and name the providers who may disclose and the persons who may receive it, by name or function (Civ. Code §56.11(b)(4) to (7)).
• State an expiration date or event, which limits the authorization to one year or less unless the person signing requests a specific date beyond a year (Civ. Code §56.11(b)(8)).

An authorization with no expiration date or event doesn’t meet the statute, and one without a specific date beyond a year is capped at a year. The fix is a specific expiration date that the signer chooses, set to match how long the rest of the incapacity documents are meant to last.

Who should be named, and what should the form say?

Name specific people, and identify providers broadly. California allows the disclosing providers to be identified by name or function (Civ. Code §56.11(b)(5)), so the form can cover “any physician, hospital, or health care provider” instead of a single clinic that may not be treating you when something happens. On the recipient side, list your health care agent and alternates, your financial agent, and your successor trustees by name.

Psychotherapy notes are handled separately. Federal law requires a specific authorization for most uses and disclosures of psychotherapy notes (45 C.F.R. §164.508(a)(2)), so a general release won’t reach them. Most families don’t need those notes, but if you want someone to have them, the form has to say so.

Can I revoke or update it?

Yes. You can revoke a HIPAA authorization in writing at any time, except to the extent a provider already acted in reliance on it (45 C.F.R. §164.508(b)(5)). You should also replace it when the people named change, such as after a divorce or a death. A form signed fifteen years ago that names an ex-spouse and a pediatrician’s office is the problem I see most.

If you’d like to see how this fits with the other incapacity documents, incapacity, powers of attorney, and health directives collects the related articles, and AHCD vs. living will vs. POLST explains which health care document does what. Parents sending a child to college face the same issue from the other direction, which I cover in why college students need medical powers of attorney.

Signing it with the rest of your plan

A HIPAA authorization belongs in the same signing as the advance health care directive and the durable power of attorney, as part of the estate plan. With me the work happens by phone and Zoom, and a mobile notary comes to you to sign. If your existing documents were drafted years ago, or you were never given an authorization at all, a review is the quickest way to find out whether the people you trust can get the information they’d need. See also: HIPAA authorization in the California estate planning glossary.